Can we stop aimbots by introducing a "Protected Input Path" that ensures that mouse input really comes from the mouse?

Question

When playing First Person Shooters online it's possible to stumble on opponents using aimbots. They are really a plague, and I was wondering whether there is anything that can be done to block them.

I have researched this a bit, and on Stack Overflow I've found a question on how aimbots work. The accepted answer explains that the aimbot reads from some memory addresses the position of an enemy relative to the player, calculates the right direction, and then sends the fake input to the game. This sending of the fake input is deemed "trivial", and this is where I think we could do something.

The aimbot can simulate, via software, the input that should come from the mouse, thus fooling the game into accepting those movements as legitimate and coming from a player's hand. Couldn't an OS make it impossible for a program to fake user input? I am thinking of something like the Protected Media Path that is integrated in Windows, and that makes it impossible to copy DRM-protected contents. It relies on HDCP, which is a licensed technology, and of course the license isn't given to rogue manufacturers (and in case it could be revoked). Couldn't OS vendors and mouse manufacturers develop a "Protected Input Path", relying on certified hardware with signed drivers, that would make it impossible for a program to fake user input?

Then, the game (whose binaries would also be signed) would only use input that comes from real mouse movement, not from another program. That is, from the player's hand, not from an aimbot.

Would this work? And in case, why isn't it done?

Answer 1

One of the things many companies realize is that cheating in games is very much like information or network security. It's a cat and mouse game.

To answer the "has something been attempted" area of questions, yes various tricks have been deployed, and continues to be "updated". Games may disable "virtual" input, input provided from certain devices, or certain inputs all together. In some games, they may disable or block certain keystrokes. I particularly remember an update to a popular free FPS where the Insert and Delete keys were effectively disabled while the game was running. Reasoning behind this was that cheats used these keys commonly.

The other area to consider is the cost/benefit. For instance, a game like Combat Arms (a free online multiplayer FPS) is victim to cheating likely because there is little to loose when a player's account is banned. The offending user can simply create another account. Games have attempted to address this with banning users by hard drive serial numbers, and so on. Again, cheaters will find ways around this, including banning IP addresses.

The key part to remember is that anti-cheats effectively work with one of the following three:

• White Lists
• Black Lists
• Behavior Analysis

When you describe the "Protected Input Path", you are effectively describing a white list. Considering the amount of hardware input devices, the manufactures, and so on, the task could be difficult. While I could see some names pushing for such an idea, others would likely be against it, because:

• This leads to a loss of cross platform capabilities.
• Who is going to manage all of this?
• What about the costs of managing this?
• How do people go about getting devices "approved"?
• Is it going to be an open specification?

Bypassing memory protections of processes in an OS such as Windows can come across easy enough as cycling does for others. Valve Corporation had discussed the idea of a rootkit for Valve Anti-Cheat, but that idea was never realized outside of academic discussions. Battleye says the following about it's product:

Fully proactive kernel-based protection system and fast dynamic and permanent scanning of the player’s system using specific and heuristic/generic detection routines for maximum effectiveness.

You can take that to mean whatever you like, but from my understanding, it's effectively a rootkit (just lacking the manipulation capabilities).

I particularly had fun once with a free online FPS title. The title in question included a third-party anti-cheat, where if you suspended the child process responsible for cheat-detection, you effectively could run whatever cheats you wanted to.

tl;dr: It may eventually come about with competitive gaming, but it's a case of cat and mouse, and there are currently easier solutions which include "global bans" and so on.